check_imap

#!/usr/bin/python3
#-------------------------------------------------------------------------------

import imaplib
import argparse
import sys
import time
import datetime
import socket
import ssl

#-------------------------------------------------------------------------------

_candebug = False
def candebug():
    global _candebug
    return _candebug
def setcandebug(value):
    global _candebug
    _candebug = value

def infomsg(msg):
    if candebug() == True:
        print(msg, flush=True)

def mapstatustoexitcode(status):
    if status=="OK":
        exitcode = 0
    elif status=="WARNING":
        exitcode = 1
    elif status=="CRITICAL":
        exitcode = 2
    elif status=="UNKNOWN":
        exitcode = 3
    else:
        exitcode = 4
    return exitcode

def exitnagios(status,message):
    exitcode = mapstatustoexitcode(status)
    print(status+": "+message, flush=True)
    sys.exit(exitcode)

#-------------------------------------------------------------------------------

original_getaddrinfo = socket.getaddrinfo

def forced_ipv6_gai_family(*args, **kwargs):
    global original_getaddrinfo
    responses = original_getaddrinfo(*args, **kwargs)
    return [response
            for response in responses
            if response[0] == socket.AF_INET6]

def forced_ipv4_gai_family(*args, **kwargs):
    global original_getaddrinfo
    responses = original_getaddrinfo(*args, **kwargs)
    return [response
            for response in responses
            if response[0] == socket.AF_INET]

#-------------------------------------------------------------------------------

def doimapcheck(protocol,hostname,port,dossl,warning,critical,timeoutvalue,timeoutstatus,certificatedays):
    try:
        start = datetime.datetime.now(datetime.UTC)
        imapconnection = None
        #socket.setdefaulttimeout(timeoutvalue)
        if dossl==True:
            ctx = ssl.create_default_context()
            imapconnection = imaplib.IMAP4_SSL(host=hostname,port=port,timeout=timeoutvalue,ssl_context=ctx)
        else:
            imapconnection = imaplib.IMAP4(host=hostname,port=port,timeout=timeoutvalue)
        if imapconnection != None:
            infomsg(str(imapconnection.PROTOCOL_VERSION))
            certexpirationparsed = None
            if dossl==True:
                infomsg(str(imapconnection.socket().version()))
                certexpirationraw = None
                try:
                    cert_data = imapconnection.socket().getpeercert()
                    infomsg(str(cert_data))
                    certexpirationraw = cert_data["notAfter"]
                    infomsg("Expiry date: "+str(certexpirationraw))
                    if certexpirationraw != None:
                        from dateutil.parser import parse
                        certexpirationparsed = parse(cert_data["notAfter"])
                except:
                    infomsg(str(traceback.format_exc()))
                    pass
            imapconnection.shutdown()

            elapsed = datetime.datetime.now(datetime.UTC)-start
            duration = elapsed.total_seconds()
            daysremaining = -1
            if dossl==True and certificatedays!="":
                if certexpirationparsed==None:
                    exitnagios("CRITICAL","cannot parse certificate expiration date '"+str(certexpirationraw)+"' | time="+str(duration)+" validity=0")
                else:
                    today = datetime.datetime.now(datetime.UTC)
                    timeremaining = certexpirationparsed.timestamp()-today.timestamp()
                    daysremaining = int(timeremaining/86400)

            if duration>=critical:
                exitnagios("CRITICAL", "it took "+str(duration)+ " seconds to answer | time="+str(duration)+" validity="+str(daysremaining))
            elif duration>=warning:
                exitnagios("WARNING", "it took "+str(duration)+ " seconds to answer | time="+str(duration)+" validity="+str(daysremaining))
            else:
                certificatedaysparts = certificatedays.split(",")
                criticaldays = int(certificatedaysparts[0])
                if len(certificatedaysparts)>1:
                    warningdays = int(certificatedaysparts[1])
                else:
                    warningdays = -1

                if daysremaining>=0 and daysremaining<criticaldays:
                    exitnagios("CRITICAL","the certificate is expiring in '"+str(daysremaining)+"' days | time="+str(duration)+" validity="+str(daysremaining))
                elif daysremaining>=0 and daysremaining<warningdays:
                    exitnagios("WARNING","the certificate is expiring in '"+str(daysremaining)+"' days | time="+str(duration)+" validity="+str(daysremaining))
                else:
                    exitnagios("OK", "it took "+str(duration)+ " seconds to answer | time="+str(duration)+" validity="+str(daysremaining))
    except socket.error:
        exitnagios(timeoutstatus,"socket error | time=-1 validity=-1")
    exitnagios("CRITICAL","unexpected error | time=-1 validity=-1")

#-------------------------------------------------------------------------------

def main(forcedargs=None):
    parser = argparse.ArgumentParser()
    parser.add_argument("-4", "--ipv4",              action="store_true",  dest="ipv4",             default=False,                                help="use ipv4 (exclusive with ipv6)")
    parser.add_argument("-6", "--ipv6",              action="store_true",  dest="ipv6",             default=False,                                help="use ipv6 (exclusive with ipv4)")
    parser.add_argument("-0", "--ipv0",              action="store_true",  dest="ipv0",             default=False,                                help="do not specify ip protocol version")
    parser.add_argument("-H", "--hostname",                                dest="hostname",         default="",                                   help="server to check")
    parser.add_argument("-p", "--port",                                    dest="port",             default=143,                                  help="port to use, usually 143 or 993")
    parser.add_argument("-w", "--warning",                                 dest="warning",          default=10,                                   help="warning time (float)")
    parser.add_argument("-c", "--critical",                                dest="critical",         default=15,                                   help="critical time (float)")
    parser.add_argument("-S", "--ssl",               action="store_true",  dest="ssl",              default=False,                                help="use ssl")
    parser.add_argument("-t", "--timeout",                                 dest="timeout",          default="30:CRITICAL",                        help="timeout value:STATUS")
    parser.add_argument("-C", "--certificatedays",                         dest="certificatedays",  default="5,20",                               help="minimum number of days a certificate has to be valid crit,warn")
    parser.add_argument("-®", "--debug",             action="store_true",  dest="debug",            default=False,                                help="be more verbose")
    args = parser.parse_args(forcedargs)

    setcandebug(args.debug)

    protocol = None
    exclist = 0
    if args.ipv0 == True :
        protocol = ""
        exclist = exclist+1
    if args.ipv4 == True :
        protocol = "-4"
        exclist = exclist+1
        socket.getaddrinfo = forced_ipv4_gai_family
    if args.ipv6 == True :
        protocol = "-6"
        exclist = exclist+1
        socket.getaddrinfo = forced_ipv6_gai_family
    if (exclist>1) :
        exitnagios("CRITICAL","select ip protocol version 4 or 6, or 0 to relay on OS handling")
    elif (exclist<1) :
        exitnagios("CRITICAL","no protocol selected")

    parts = args.timeout.split(":")
    timeoutvalue = int(parts[0])
    if len(parts)>1:
        timeoutstatus = parts[1]
    else:
        timeoutstatus = "CRITICAL"
    if timeoutstatus in ["OK", "WARNING", "CRITICAL", "UNKNOWN"]:
        doimapcheck(protocol,args.hostname,int(args.port),args.ssl,int(args.warning),int(args.critical),timeoutvalue,timeoutstatus,args.certificatedays)
    else:
        exitnagios("CRITICAL","timeout status is not valid")

#-------------------------------------------------------------------------------

if __name__ == "__main__":
    main()

#-------------------------------------------------------------------------------